Drupal Has Terrible Access Control
http://www.hiveminds.co.uk/node/899

Hiveminds
2005

Abstract:

After a week of fighting with it I have come to the conclusion that Drupal access control modules are all inadequate and are based on some weak database design. Taxonomy access and node access are flawed from the start. This type of access control where the assets are assigning their own internal security is not scalable and suffers from very high database overhead.